undelete on ext3?

[inetd]

I have read some mailing list from internet telling that is is impossible to undelete a file that was deleted accidentally if the filesystem is ext3. Is it right?

How about ext2?

Thanks.

 

[usige]

I don't know if I'd say it's impossible. It can be a lot of work, but you might be able to recover the files. The longer the filesystem is mounted after the file is deleted the less likely a recovery. One possibility is to use Lazarus from the Coroner's Toolkit. You can read a bit about it here:

http://www.cert.org/security-improvement/implementations/i046.03.html

I have never tried it on ext3 but since ext3 is basically an extention of ext2 I would think it would work.

Hope that helps.

 

[inetd]

I read some posts from the internet saying that when a delete operation is performed in ext3, the kernel will zero the block that the file indirected. So after deletion, the deleted file contains all zero.

 

[Morsing]

That's not true. The data is still there but can be overwritten.

Cheers

Henrik Morsing
Certified AIX 4.3 Systems Administration
& p690 Technical Support

 

[usige]

OK, inetd. After doing some research you are partially correct. What happens is the whole block isn't zero'd only the indirect inodes are zero'd. Based on this you could rebuild the indirect inode map by hand and be able to recover the file. Extremly difficult? Yes. Impossible? No.